What happens to a leaver's Microsoft 365 account and files?

The short version

• Same day: reset the password, select Sign out of all sessions, then Block sign-in.
• Wipe work data from their phone if it was set up for work mail.
• Give a manager access to their mailbox and OneDrive before you delete anything.
• Removing a license starts a 30-day clock on their email. Deleting the account starts one on OneDrive.
• Remove the license and reuse it, or reduce your license count so you stop paying.

How is this different from removing their email?

Our help page on removing an email account for someone who left covers the mailbox: locking it, keeping the mail, and forwarding or auto-replying. In Microsoft 365, a person is more than a mailbox. They also have OneDrive files, Teams chats, devices and a paid license. This guide covers those parts, in the order Microsoft’s former employee guide sets out.

What should I do, step by step?

1. Stop them signing in (the day they leave)

From Microsoft’s step 1 page:

1. In the Microsoft 365 admin center, go to Users, then Active users.
2. Select the person, then Reset password. Choose whether to create one automatically, then select Reset password and Close.
3. Select their name again. On the Account tab, select Sign out of all sessions.
4. Select Block sign-in, tick Block this user from signing in, and select Save changes.

Microsoft says the sign-out takes effect within about an hour, and blocking can take up to 24 hours. That’s why the password reset comes first: it works straight away. If they use Outlook on the web, they may stay in until they refresh or open another app.

2. Keep their mailbox

Follow our remove an email account steps: keep the mail, then forward the address or convert it to a shared mailbox so a colleague can keep answering it.

3. Wipe work data from their phone

If their phone was set up for work email, Microsoft’s guide includes wiping and blocking it from the Exchange admin center. On Business Premium, Intune can remove just the company data from a personal phone.

4. Hand over their OneDrive

Microsoft’s OneDrive retention page says that, by default, a deleted user’s manager is automatically given access to their OneDrive. The manager then has 30 days to copy what they need. Seven days before the end, Microsoft sends a reminder. After that, the OneDrive moves to a recycle bin and shared links stop working.

Two catches:

• That automatic access only works if a manager is set on the person’s profile, or a secondary owner is set in the SharePoint admin center. Check before you delete.
• Microsoft says the 30-day clock starts only when the account is deleted. Blocking sign-in or removing the license doesn’t start it.

Better still, move business files into a shared SharePoint library before the account goes. See where files should live.

5. Deal with the license

Microsoft’s license page says that when you remove a license, Exchange Online data for that account is held for 30 days, then deleted and can’t be recovered. OneDrive files aren’t deleted unless the user is deleted.

So:

• Replacing them soon? Delete the account once mail and files are handed over. Microsoft says the license is immediately free to assign to the new person.
• Not replacing them? Free the license, then reduce the number of licenses in your subscription, or you’ll keep paying for it. See licenses and billing.

6. Delete the account last

Microsoft says deleting the account stops mail to it from being received. Do it only when the forward or shared mailbox is in place and the manager has what they need.

Why does the order matter?

Every early step can be undone. The last one can’t, after 30 days. The most common regret in offboarding is deleting first and asking about the files later. Microsoft’s own sequence protects against that: block, save, hand over, then delete.

What are the common mistakes?

• Blocking sign-in and stopping there. Microsoft says blocking can take up to 24 hours. Reset the password too.
• No manager on the profile. Nobody gets automatic OneDrive access, and nobody gets warned before it’s deleted.
• Removing the license “to save money” before saving mail. That starts the 30-day mail deletion.
• Forgetting other admin roles. If they were an admin, remove the role. See admin roles.
• Forgetting other accounts. Website logins, Google profile and shared passwords need changing too. See share access safely.
• Legal holds. If there’s a dispute, keep everything and ask your adviser first. This isn’t legal advice.

What if they still have access?

• Check the password was reset, not just the sign-in blocked.
• Sign them out of all sessions again.
• Check for app passwords or mail apps on a personal device, and wipe work data from it.
• Look at their sign-in activity in the Entra admin center for unexpected locations.

How much does it cost, and how long does it take?

The steps are free and take an admin about 20 minutes, plus the 30 days a manager has to copy files. The license keeps costing money until you reduce your license count.

How does E-3 handle this?

Removing a leaver’s email comes up nearly 60 times in our records. For Microsoft 365 clients, we act only on requests from people we know on the account, and we follow Microsoft’s order: lock, save, hand over, then delete with your approval. We never need the leaver’s password.

Related questions

• How do I remove an email account for someone who left?
• Where should our files live?
• How do licenses and billing work?
• Back to the complete Microsoft 365 guide

Sources

1. Remove a former employee: overview (Microsoft Learn)
2. Step 1: Prevent user sign-in and block access (Microsoft Learn)
3. OneDrive retention and deletion (Microsoft Learn)
4. Assign or unassign licenses (Microsoft Learn)